CVE-2026-77812: CWE-311 Missing Encryption of Sensitive Data in DJI Neo

DJI drones transmit DUML protocol messages over BLE unencrypted, including Wi-Fi credentials exchanged during connection attempts or QuickTransfer mode. An attacker with a BLE sniffer can passively capture the Wi-Fi SSID, PSK, and session UUID, which uniquely identifies trusted clients. This allows the attacker to join the drone's Wi-Fi network, interact with exposed services, and decrypt traffic. The credentials do not change between sessions unless manually reset, and the attack is fully passive, leaving no trace. Affected models include various DJI Neo, Flip, Air, Avata, Mavic, and Mini drones with firmware versions below specified thresholds. Remediation requires a vendor firmware update.

An attacker within BLE range can recover Wi-Fi credentials in cleartext, join the drone's internal Wi-Fi network, bypass client authentication by replaying the session UUID, and decrypt Wi-Fi traffic between the drone and legitimate users. The vulnerability allows persistent unauthorized access without detection, posing significant confidentiality and integrity risks to drone communications and control.

Remediation requires applying a firmware update from DJI. There is no effective user-side mitigation to fully address this vulnerability without upgrading the firmware. Users should monitor DJI advisories for the official patch release and update affected drones promptly.